Explanation

Security

On this page

This page is for workspace admins and security reviewers. It covers the Security page of the Admin console, how Conclude handles your data, and how each app keeps secrets such as API keys. The Security Policy is the canonical statement. It links the Vanta Trust Center, the Privacy Policy and the Data Processor Agreement.

Security settings

Admin console > Users and access > Security  has one setting, Enable automatic sign out. Tick it and enter the period of inactivity after which Conclude signs users out. The rest of this page is about how Conclude handles your data.

Certifications and hosting

Conclude is SOC 2 Type II certified, HIPAA compliant and GDPR compliant. Compliance controls are published in the Vanta Trust Center.

Data is encrypted in transit with TLS 1.2 or higher, and at rest with AES-256. Storage runs on Google Cloud Platform, with automated backups and point-in-time recovery. Relational data uses CloudSQL/PostgreSQL, and caching uses Memorystore/Valkey. Both run in high-availability configurations.

Data handling

What is stored. Conclude stores the minimal data needed to operate. That is metadata about user interactions, such as technical identifiers and logs of actions taken in Conclude.

How long conversations are stored. Conclude stores conversation content only where a feature needs it:

  • Connected channels: Connect does not store messages or files. They pass through Conclude only while it converts them between Slack and Microsoft Teams. Conclude keeps message metadata, such as message IDs, so that edits, replies and deletions stay in sync
  • Channels with an agent: Conclude stores recent messages for a short time, so the agent can build prompts for the AI model you selected. It sends these messages to the AI provider, Anthropic or OpenAI, to generate a response. Neither Conclude nor the provider uses your data to train AI models
  • Channels with an app: Conclude stores ticket content, including ticket messages, until the ticket is deleted or your data is erased

If you add an agent or an app to a connected channel, the storage for that feature applies to the channel.

What is collected. From Slack, Microsoft Teams, Jira and Zendesk, Conclude collects workspace names, user contact information, channel data, actions within channels and usage statistics.

Retention and deletion. Conclude keeps your data while your agreement is active. When you request deletion, or when your agreement ends, Conclude erases the data within the timeframe in the Data Processor Agreement. You can ask to have your data returned before it is erased. Backup copies are erased on the ordinary backup rotation cycle.

Sub-processors. Sub-processors include Google for hosting, the providers that send email and SMS from apps, and OpenAI or Anthropic when Agents is enabled. The full list is in Section 10 of the Data Processor Agreement. Slack, Microsoft, Atlassian and Zendesk are not sub-processors. Your organization contracts with them directly.

Incident response. If there is a data breach, Conclude notifies affected parties without undue delay and takes remedial action.

Platform permissions

Conclude requests only the permissions it needs. On Slack it can read messages only in channels and direct messages where the app is a member. On Microsoft Teams it receives notifications only for the teams and chats it is installed in, and it discards data it does not need.

Two reference pages list every scope. Slack permissions covers bot token and user token scopes. Microsoft Teams permissions covers the RSC scopes used to connect platforms and the delegated scopes used for user sync.

App secrets

Some app features call third-party services with a key you supply. Most services Conclude uses need no key. The secrets dialog holds three keys:

  • an OpenAI API key,
  • a Google reCAPTCHA v3 private key, and
  • a SendGrid email API key

Conclude stores secrets apart from the app definition. They are not part of the app’s YAML, and each installed app has its own set.

The secret key of a lookup endpoint is a different store. It names an organization-level Secret, not a per-app key. See Lookup.

To edit the secrets of an installed app, run this in Slack:

/c app secrets #channel

A dialog opens for the app installed in #channel. Each service shows Add when no key is saved, and View when one is saved. Select a service to open a field for the key. OK returns to the main dialog. Save writes the keys and the Authorized users list. Apps distributed with restricted code access refuse the command.

Access follows these rules:

  • Until secrets have been saved for the app, anyone who can open the app’s code can open the dialog
  • When you save, you are added to Authorized users if the list is empty. From then on only listed users can open the dialog
  • You cannot remove yourself from the list
  • If you clear every key and you are the only authorized user, the secrets record is removed and access opens again